Automatic Analysis and Reasoning Based on Vulnerability Knowledge Graph

Critical Relation Path Aggregation-Based Industrial Control Component Exploitable Vulnerability Reasoning

“…An original intention of KG-based methods is to excavate implicit relationships from more instances. By calculating the conditional probability of a pair of weaknesses belonging to the same product entity in a vulnerability KG, Qin et al mined hidden weakness chains of compromised products in a statistical way [19].…”

“…Algorithm 1: Continued ( 16) remove the last elements from cur_p_rela and cur_p_ent (17) end if (18) for each entity adj_ent and relation adj_rela adjacent to cur_ent do (19) if adj_ent is not in cur_p_ent then (20) DFS_SIM (adj_rela, adj_ent, cur_p_rela, cur_p_ent, p_vec, cur_sim, cur_len, e t , max_p_len, q_r_vec, cri_p_set) (21) end if (22) end for (23) remove the last elements from cur_p_rela and cur_p_ent (24) end function…”

Multi-Source Knowledge Reasoning for Data-Driven IoT Security

“…The inference engine perceives and separates the abnormalities based on the instances repository and the user-defined inference rules to achieve the goal of automatically responding to threats. We analyzed the characteristics of multiple knowledge bases of IoT security, and we proposed an IoT Security Threat Ontology (IoTSTO), which was inspired by UCO [12], IoTSec [19], and VulKG [43]. Furthermore, some concepts were extracted from these works, but with many details adjusted to make the ontology more suitable for knowledge bases.…”

“…Campaign can be expressed by the tactics, techniques, resources (tools, malware), groups that issued the malicious activities, and the mitigations that defend the system against this campaign. We analyzed the characteristics of multiple knowledge bases of IoT security, and we proposed an IoT Security Threat Ontology (IoTSTO), which was inspired by UCO [12], IoTSec [19], and VulKG [43]. Furthermore, some concepts were extracted from these works, but with many details adjusted to make the ontology more suitable for knowledge bases.…”

“…The current cyber security ontology models focus on different scopes of information. Some models focus on the integration of IoT assets, vulnerabilities, and weaknesses [19,43,49], and some models focus on modeling attack in the IoT environment [12,18,20,39,50,51]. Our proposed ontology model focuses on the information on IoT assets, vulnerabilities, weaknesses, attack patterns, techniques, and tactics, which gives a holistic view of the cyber security situation and is more comprehensive than the other models.…”